Privacy Notice

1. Who we are

Folklore London Limited (“Folklore”, “we”, “us”, “our”) is a B2B lead generation agency providing AI-powered prospect research and individually crafted outreach services to clients. We are registered in England and Wales.

Company name

Folklore London Limited

Company number

16972953

ICO registration

ZC100745

Trading as

Folklore

Registered address

The Old Rectory, Berins Hill, Wallingford, OX10 6QX

Contact

[email protected]

This Privacy Notice explains how we collect, use, and protect personal data in connection with our business activities. It applies to:

• business contacts and prospects we research and contact as part of our lead generation services;
• business contacts we research and contact for the purposes of our own business development;
• visitors to our website at folklore.london; and
• representatives of clients and prospective clients we communicate with.

This notice does not apply to personal data we process on behalf of our clients as a data processor – that processing is governed by the Data Processing Schedule forming part of our Standard Terms of Service.

2. The personal data we hold

2.1 Business contacts and prospects

When conducting research and outreach – whether on behalf of our clients or for Folklore’s own business development – we collect and process the following categories of personal data about business contacts:

• name and job title;
• business email address and direct dial or mobile number (where available from licensed data providers);
• LinkedIn profile URL and publicly available profile information;
• company name, sector, and size;
• professional background and publicly available career history; and
• any information you provide when you respond to our outreach.

We do not intentionally seek to process special category data (such as health information, political opinions, or racial or ethnic origin). Research is generally conducted using publicly available sources or licensed third-party B2B data providers. Our outreach is directed at individuals in their professional capacity and we do not send unsolicited marketing to consumers.

2.2 Intelligence Dossiers

Where an outreach recipient responds positively to our client’s outreach, we may prepare a more detailed Intelligence Dossier on that individual. This contains a structured summary of the professional research described above – ownership background, career history, relevant business context – compiled to help our client have an informed first conversation. Intelligence Dossiers are created for and transferred to our clients, who hold them as data controllers in their own right. Folklore does not retain copies of dossiers beyond the attribution period specified in the relevant client contract.

2.3 Website visitors

When you visit folklore.london, we may collect standard technical data including IP address, browser type, pages visited, and time of visit, via analytics tools.

2.4 Client contacts

If you represent a client or prospective client, we hold contact details you provide to us – name, email, phone number, and role – for the purposes of managing our business relationship.

3. How we obtain personal data

We collect personal data from the following sources:

• publicly available sources, including LinkedIn, company websites, Companies House, news articles, and industry databases;
• licensed third-party B2B data providers;
• directly from you, where you contact us or respond to our outreach; and
• from our clients, where they provide us with contact lists or account access as part of a service engagement – in which case we act as data processor under a separate Data Processing Schedule and this notice does not apply to that data.

4. Why we process your data and our legal basis

4.1 Outreach on behalf of clients (independent controller)

Where we independently research and contact business prospects on behalf of our clients using data we have sourced ourselves, we act as an independent data controller. Our legal basis is legitimate interests under Article 6(1)(f) UK GDPR. We have conducted a Legitimate Interests Assessment and concluded that this processing is justified because:

• our outreach is directed at business email addresses and LinkedIn profiles, targeting individuals in their professional capacity;
• we contact individuals in their professional capacity, on matters relevant to their role;
• every communication includes a clear and easy means to opt out of further contact; and
• our activities are unlikely to cause harm to the individuals contacted.

4.2 Folklore’s own business development outreach

Where we research and contact business contacts for the purposes of promoting Folklore’s own services, we again act as data controller. Our legal basis is legitimate interests under Article 6(1)(f) UK GDPR on the same basis as clause 4.1 above. Such outreach is directed at senior professionals in their professional capacity, where we have reasonable grounds to believe our services may be of professional relevance. We maintain a suppression list of individuals who have opted out and check this before any new campaign. Opt-out requests are honoured immediately.

4.3 Client relationship management

We process contact details of client representatives to manage and administer our business relationships. Our legal basis is legitimate interests in managing our commercial relationships and, where applicable, the performance of a contract.

4.4 Website analytics

We use analytics to understand how our website is used and to improve it. Our legal basis is legitimate interests in operating and improving our online presence.

5. How we share your data

We do not sell personal data. We may share personal data with:

• our clients, where we pass on research outputs or Intelligence Dossiers as part of our services – clients receive this data as data controllers in their own right and are responsible for their own compliance with Data Protection Legislation;
• third-party tools and platforms used to deliver our services, including licensed B2B data providers, LinkedIn, email infrastructure providers, AI research and drafting tools, and cloud storage platforms – we take reasonable steps to ensure these are engaged under appropriate data processing terms;
• professional advisers (legal, financial, insurance) where necessary and on a confidential basis; and
• regulatory authorities or law enforcement where required by law.

We do not transfer personal data outside the United Kingdom without ensuring an appropriate safeguard is in place under Data Protection Legislation.

6. How long we keep your data

Prospect contact records (controller – independently researched)

Duration of the relevant campaign, plus the attribution period agreed with our client. Opt-out records retained indefinitely to prevent re-contact.

Intelligence Dossiers

Transferred to client on completion. Folklore does not retain copies beyond the end of the attribution period.

Client-provided prospect lists (processor)

Returned or deleted within 30 days of engagement end. Contact records may be retained during the attribution period for success fee administration only, then deleted. Governed by Data Processing Schedule.

Folklore own BD prospect records

Generally up to 12 months from last contact, or until you opt out. Opt-out records retained indefinitely.

Client contact details

Duration of the client relationship and 6 years thereafter, to comply with statutory accounting and legal record-keeping obligations.

Website analytics data

Up to 26 months in anonymised or aggregated form.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access

– to request a copy of the personal data we hold about you.

Right to rectification

– to ask us to correct inaccurate data.

Right to erasure

– to ask us to delete your data in certain circumstances.

Right to object

– to object to processing based on legitimate interests. You can opt out of our outreach at any time by replying to any message we send or by emailing [email protected].

Right to restriction

– to ask us to limit how we use your data.

Right to data portability

– to receive your data in a structured, commonly used format.

To exercise any of these rights, please email [email protected]. We will respond within one calendar month.

If you have received outreach from us on behalf of a client and wish to opt out of further contact, please reply directly to that outreach or email [email protected]. We will honour your request immediately and notify the relevant client.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Data is primarily stored in cloud-based systems with appropriate access controls, including multi-factor authentication on key systems. We seek to minimise storage of personal data on local devices. We take reasonable steps to ensure that sub-processors implement appropriate security measures in connection with any personal data processed on our behalf.

9. Changes to this notice

We may update this Privacy Notice from time to time. The current version will always be available at folklore.london. Where changes are material, we will take reasonable steps to bring them to your attention.

10. Contact us

If you have any questions about this Privacy Notice or how we handle your personal data, please contact us:

Email: [email protected]

Post: Folklore London Limited, The Old Rectory, Berins Hill, Wallingford, OX10 6QX